Sub-processors

Last Updated: 17 May 2026 · Version 1.0.1

This page lists every third party that YourCart Ltd (registered as YOURCART.STORE LTD, Companies House No. 15316188) engages to help deliver the YourCart service. These third parties are called "sub-processors" because they process Personal Data on our behalf, under our contract with you, in service of operating your storefront and branded mobile apps.

We commit to keeping this page accurate. Whenever we add, replace, or materially change a sub-processor, we notify active merchants by email at least 14 days before the change takes effect, in line with section 5 of our Data Processing Agreement.

Current sub-processors

Sub-processor	Purpose	Primary data location	International transfer mechanism
Stripe Payments Europe Ltd	Subscription billing, payment-method tokenisation, customer payment processing, Stripe Connect payouts to merchant bank accounts	Ireland (primary), United States (failover)	Stripe is the Controller of payment-card data under its own privacy policy; UK adequacy regulations apply for the EEA → UK leg of any data flow back to YourCart
Google LLC (Firebase)	User authentication (sign-up, sign-in, password reset), push-notification delivery via Firebase Cloud Messaging, Firestore for ephemeral application state	United States	UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses
Microsoft Ireland Operations Limited (Azure)	Application hosting (the YourCart APIs), SQL Server (the primary data store), Blob Storage (file uploads, BugReport screenshots), Key Vault (secrets)	UK South region (primary)	Data residency is contractually committed to the UK under the Microsoft Online Services DPA; no cross-border transfer for primary processing. Microsoft Ireland Operations Limited is the EMEA-region contracting entity for Azure under the Microsoft Online Services DPA (registered office: 70 Sir John Rogerson's Quay, Dublin, D02 R296, Ireland).
Mailgun Technologies Inc.	Transactional email delivery (account, billing, password-reset, support replies, BugReport admin notifications)	United States	UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses

What is and isn't a sub-processor

A sub-processor is a third party that processes the personal data of your end customers (the people who buy from your YourCart-hosted storefront and apps) on your behalf, where that processing is part of how YourCart operates the service.

The following are not sub-processors and are not listed above:

Third-party platforms whose terms your end customer accepts directly. Apple (App Store), Google (Play Store) — when an end customer downloads your branded app, their relationship with the store is governed by the store's own privacy policy, not by us.
Payment networks (Visa, Mastercard, etc.) sitting downstream of Stripe — Stripe's own DPA and disclosures cover these.
Internet service providers, DNS providers, certificate authorities — these are infrastructure that touches all internet traffic; they do not have a Processor relationship with us in the GDPR sense.
Our own professional advisers (accountants, auditors, legal counsel) — when they handle data, it is under separate duties of confidentiality, not as Processors. Disclosed in our Privacy Policy §4.2.

If a sub-processor we work with engages further sub-processors of its own (a "sub-sub-processor"), those are governed by the original sub-processor's contract and disclosures, not by ours. For example, Microsoft Azure may use further sub-processors to deliver Azure services; Microsoft discloses those at microsoft.com/licensing/docs/view/Lists-of-Subcontractors.

How we notify you of changes

When a sub-processor is added or replaced, we send an email to the address registered against your YourCart Account at least 14 days before the new sub-processor begins processing your data. The email tells you:

The name of the new sub-processor
The category of data they will process and why
The country where they host data
The transfer mechanism, if outside the United Kingdom
The proposed effective date

If you object to a change, your right to object is set out in section 5 of the Data Processing Agreement. In summary: your remedy is to terminate the YourCart service for convenience under the Terms of Service before the change takes effect. You are not entitled to a refund beyond what the Refund Policy provides.

We may, in our discretion, engage with reasonable objections, but we are not required to alter our sub-processor selection in response to one.

When a sub-processor's role substantially changes (a meaningfully different category of data, a new country of processing, a new transfer mechanism), the same 14-day notification applies. Pure operational changes — for example, Microsoft Azure adding a new failover region within the United Kingdom — do not.

Version history

Version	Date	Change
1.0	2026-05-07	Initial draft. Four sub-processors: Stripe, Google Firebase, Microsoft Azure, Mailgun.
1.0.1	2026-05-07	Microsoft Azure contracting entity corrected from "Microsoft Corporation" to "Microsoft Ireland Operations Limited" (the EMEA contracting entity under the Microsoft Online Services DPA). No scope or data-flow change.

Future material changes are appended here in addition to the email notification, so the public history of the list is auditable.

Contact

YourCart Ltd
Email: admin@yourcart.store
Postal: 15 Timperley Lane, Leigh, Greater Manchester, WN7 3DZ, United Kingdom

We aim to respond to data-protection enquiries within 2 UK business days.